@crisp-e3/contracts 0.16.0 → 0.17.0

package/contracts/CRISPProgram.sol

@@ -12,9 +12,12 @@ import { IInterfold } from "@interfold/contracts/contracts/interfaces/IInterfold
 import { E3 } from "@interfold/contracts/contracts/interfaces/IE3.sol";
 import { Risc0ComputeProof } from "@interfold/contracts/contracts/lib/Risc0ComputeProof.sol";
 import { LazyIMTData, InternalLazyIMT } from "@zk-kit/lazy-imt.sol/InternalLazyIMT.sol";
-import { HonkVerifier } from "./CRISPVerifier.sol";
+import { EIP712 } from "@openzeppelin/contracts/utils/cryptography/EIP712.sol";
+import { IHonkVerifier } from "./interfaces/IHonkVerifier.sol";
+import { IVotesToken } from "./interfaces/IVotesToken.sol";
+import { IERC6372Clock } from "./interfaces/IERC6372Clock.sol";
 
-contract CRISPProgram is IE3Program, Ownable {
+contract CRISPProgram is IE3Program, Ownable, EIP712 {
   using InternalLazyIMT for LazyIMTData;
 
   /// @notice Enum to represent credit modes
@@ -43,7 +46,12 @@ contract CRISPProgram is IE3Program, Ownable {
     /// @notice Derived from token balances by the coordinator. The default.
     TOKEN,
     /// @notice Supplied by the requester via `getCensus(uint256 e3Id) returns (address[])`.
-    BY_REQUESTER
+    BY_REQUESTER,
+    /// @notice Read from the token by this contract, one input at a time. No list is enumerated
+    /// and no root is posted, so there is no census producer to trust. `publishInput` calls
+    /// `getPastVotes` for the slot and passes the result to the circuit as a public input, which
+    /// is why this mode uses the `crisp_onchain` verifier rather than the `crisp` one.
+    ONCHAIN
   }
 
   /// @notice Struct to store all data related to a voting round
@@ -55,6 +63,16 @@ contract CRISPProgram is IE3Program, Ownable {
     uint256 numOptions;
     CreditMode creditMode;
     CensusMode censusMode;
+    /// @notice The token that voting power is read from. Only used by `CensusMode.ONCHAIN`.
+    address token;
+    /// @notice The smallest voting power that may cast an input. Only used by
+    /// `CensusMode.ONCHAIN`, where eligibility is checked per input instead of by a census.
+    uint256 minVotingPower;
+    /// @notice Credits given to each eligible voter under `CreditMode.CONSTANT`.
+    uint256 credits;
+    /// @notice The timepoint that voting power is read at, in the ERC-6372 clock units of the
+    /// token. Recorded when the round is requested, so it is the same for every input.
+    uint48 snapshot;
   }
 
   // Constants
@@ -75,7 +93,17 @@ contract CRISPProgram is IE3Program, Ownable {
   IInterfold public interfold;
   IRiscZeroVerifier public risc0Verifier;
   bytes32 public imageId;
-  HonkVerifier private immutable honkVerifier;
+  /// @notice Verifies ballots for the census modes that prove membership of a Merkle tree.
+  IHonkVerifier private immutable honkVerifier;
+  /// @notice Verifies ballots for `CensusMode.ONCHAIN`, whose circuit has no Merkle inputs and
+  /// takes voting power as a public input instead.
+  IHonkVerifier private immutable onchainHonkVerifier;
+
+  /// @notice The EIP-712 type of the message a voter signs to authorise one ballot.
+  /// @dev The digest binds the signature to the round, the slot, and this exact ciphertext. The
+  /// chain id and this contract address come from the EIP-712 domain, so a signature cannot be
+  /// replayed onto another round, another slot, another ballot, or another deployment.
+  bytes32 private constant BALLOT_TYPEHASH = keccak256("Ballot(uint256 e3Id,address slot,bytes32 ciphertextCommitment)");
 
   // Mappings
   mapping(uint256 e3Id => RoundData) e3Data;
@@ -94,6 +122,16 @@ contract CRISPProgram is IE3Program, Ownable {
   /// @notice A requester-supplied census names who may vote, not how much each vote weighs, so it
   /// only has meaning when every voter carries the same credits.
   error CensusModeRequiresConstantCredits();
+  /// @notice `CensusMode.ONCHAIN` reads voting power from a token, so it cannot run without one
+  /// that answers `getPastVotes`.
+  error CensusModeRequiresToken();
+  /// @notice An `ONCHAIN` round with constant credits must grant a non-zero allowance, or it
+  /// bounds every ballot to zero and can only accept masks.
+  error InvalidCredits();
+  /// @notice The slot holds less voting power than the round requires, so it cannot be written to.
+  /// @dev Raised for mask inputs as well as real votes. Under `CensusMode.ONCHAIN` this check
+  /// replaces the Merkle membership proof that gates both branches in the other modes.
+  error SlotNotEligible();
   error InvalidCensusMode();
   error SlotIsEmpty();
   error MerkleRootNotSet();
@@ -111,17 +149,38 @@ contract CRISPProgram is IE3Program, Ownable {
   /// @param _risc0Verifier The RISC Zero verifier address
   /// @param _honkVerifier The honk verifier address
   /// @param _imageId The image ID for the guest program
-  constructor(IInterfold _interfold, IRiscZeroVerifier _risc0Verifier, HonkVerifier _honkVerifier, bytes32 _imageId) Ownable(msg.sender) {
+  constructor(
+    IInterfold _interfold,
+    IRiscZeroVerifier _risc0Verifier,
+    IHonkVerifier _honkVerifier,
+    IHonkVerifier _onchainHonkVerifier,
+    bytes32 _imageId
+  ) Ownable(msg.sender) EIP712("CRISP", "1") {
     if (address(_interfold) == address(0)) revert InterfoldAddressZero();
     if (address(_risc0Verifier) == address(0)) revert Risc0VerifierAddressZero();
     if (address(_honkVerifier) == address(0)) revert InvalidHonkVerifier();
+    if (address(_onchainHonkVerifier) == address(0)) revert InvalidHonkVerifier();
 
     interfold = _interfold;
     risc0Verifier = _risc0Verifier;
     honkVerifier = _honkVerifier;
+    onchainHonkVerifier = _onchainHonkVerifier;
     imageId = _imageId;
   }
 
+  /// @notice The digest a voter signs to authorise one ballot.
+  /// @dev Computed for every input, and for mask inputs as well as real votes. The circuit ignores
+  /// it on the mask branch, but the contract must not skip it: a digest that were computed only
+  /// for real votes would let an observer tell the two apart on-chain, which is exactly what mask
+  /// inputs exist to prevent.
+  /// @param e3Id The E3 the ballot belongs to.
+  /// @param slot The slot address the ballot is written to.
+  /// @param ciphertextCommitment The commitment to the ballot ciphertext.
+  /// @return The EIP-712 digest.
+  function ballotDigest(uint256 e3Id, address slot, bytes32 ciphertextCommitment) public view returns (bytes32) {
+    return _hashTypedDataV4(keccak256(abi.encode(BALLOT_TYPEHASH, e3Id, slot, ciphertextCommitment)));
+  }
+
   /// @notice Sets the Merkle root for an E3 program. Can only be set once.
   /// @param _e3Id The E3 program ID
   /// @param _root The Merkle root to set.
@@ -199,34 +258,9 @@ contract CRISPProgram is IE3Program, Ownable {
     if (msg.sender != address(interfold) && msg.sender != owner()) revert CallerNotAuthorized();
     if (e3Data[e3Id].paramsHash != bytes32(0)) revert E3AlreadyInitialized();
 
-    // Scoped so the decoded values do not outlive their use: `validate` is close enough to the
-    // stack limit that holding all six of them alongside the parameters exceeds it.
-    {
-      // One decode, every field required. `censusMode` is read as a uint and range-checked rather
-      // than decoded straight into the enum, so an unrecognised value gives a named error instead
-      // of a bare panic.
-      (, , uint256 numOptions, CreditMode creditMode, , uint256 rawCensusMode) = abi.decode(
-        customParams,
-        (address, uint256, uint256, CreditMode, uint256, uint256)
-      );
-      // The circuit asserts `num_options <= MAX_OPTIONS`, so a round configured above it accepts no
-      // ballot at all. Reject at request time rather than stranding a round nobody can vote in.
-      if (numOptions < 2 || numOptions > MAX_VOTE_OPTIONS) revert InvalidNumOptions();
-      if (rawCensusMode > uint256(type(CensusMode).max)) revert InvalidCensusMode();
-
-      // Rejected here rather than by the coordinator, so a combination that can never work costs
-      // nothing: this reverts in the same transaction that requests the E3, before any fee is paid.
-      if (CensusMode(rawCensusMode) == CensusMode.BY_REQUESTER && creditMode != CreditMode.CONSTANT) {
-        revert CensusModeRequiresConstantCredits();
-      }
-
-      // we need to know the number of options for decoding the tally
-      e3Data[e3Id].numOptions = numOptions;
-      // we want to save the credit mode so it can be verified on chain by everyone
-      e3Data[e3Id].creditMode = creditMode;
-      // recorded so anyone can verify which electorate the round was requested against
-      e3Data[e3Id].censusMode = CensusMode(rawCensusMode);
-    }
+    // Delegated to its own frame rather than scoped inline: `validate` is close enough to the
+    // stack limit that holding the six decoded values alongside the parameters exceeds it.
+    _initRound(e3Id, customParams);
 
     e3Data[e3Id].paramsHash = keccak256(e3ProgramParams);
 
@@ -236,6 +270,79 @@ contract CRISPProgram is IE3Program, Ownable {
     return ENCRYPTION_SCHEME_ID;
   }
 
+  /// @notice Decode the round configuration and record it.
+  /// @dev One decode, every field required. `censusMode` is read as a uint and range-checked
+  /// rather than decoded straight into the enum, so an unrecognised value gives a named error
+  /// instead of a bare panic.
+  /// @param e3Id The E3 being configured.
+  /// @param customParams The ABI-encoded round configuration.
+  function _initRound(uint256 e3Id, bytes calldata customParams) internal {
+    (address token, uint256 minVotingPower, uint256 numOptions, CreditMode creditMode, uint256 credits, uint256 rawCensusMode) = abi.decode(
+      customParams,
+      (address, uint256, uint256, CreditMode, uint256, uint256)
+    );
+
+    // The circuit asserts `num_options <= MAX_OPTIONS`, so a round configured above it accepts no
+    // ballot at all. Reject at request time rather than stranding a round nobody can vote in.
+    if (numOptions < 2 || numOptions > MAX_VOTE_OPTIONS) revert InvalidNumOptions();
+    if (rawCensusMode > uint256(type(CensusMode).max)) revert InvalidCensusMode();
+
+    // Rejected here rather than by the coordinator, so a combination that can never work costs
+    // nothing: this reverts in the same transaction that requests the E3, before any fee is paid.
+    if (CensusMode(rawCensusMode) == CensusMode.BY_REQUESTER && creditMode != CreditMode.CONSTANT) {
+      revert CensusModeRequiresConstantCredits();
+    }
+
+    // ONCHAIN reads every voter's power from this token, so a round without one accepts no ballot
+    // at all. Same reasoning as the numOptions bound: fail before the fee is paid.
+    if (CensusMode(rawCensusMode) == CensusMode.ONCHAIN && token == address(0)) {
+      revert CensusModeRequiresToken();
+    }
+
+    // An ONCHAIN round hands `credits` to the circuit as the voting-power bound, so zero credits
+    // bound every ballot to zero: only a mask would be accepted, and the round would tally
+    // nothing. Checked for ONCHAIN only — the Merkle modes take the bound from the census leaf,
+    // where `credits` never reaches the circuit and the contract has nothing to check.
+    if (CensusMode(rawCensusMode) == CensusMode.ONCHAIN && creditMode == CreditMode.CONSTANT && credits == 0) {
+      revert InvalidCredits();
+    }
+
+    RoundData storage round = e3Data[e3Id];
+    // we need to know the number of options for decoding the tally
+    round.numOptions = numOptions;
+    // we want to save the credit mode so it can be verified on chain by everyone
+    round.creditMode = creditMode;
+    // recorded so anyone can verify which electorate the round was requested against
+    round.censusMode = CensusMode(rawCensusMode);
+    round.token = token;
+    round.minVotingPower = minVotingPower;
+    round.credits = credits;
+
+    // The snapshot is taken here rather than supplied by the requester. This function runs in the
+    // transaction that requests the E3, so `clock() - 1` is the last finalized timepoint of the
+    // round, and a requester cannot name a timepoint that suits it. Recording it once also makes
+    // every input of the round read the same electorate.
+    if (CensusMode(rawCensusMode) == CensusMode.ONCHAIN) {
+      // Checked before any call is attempted. A call to an address with no code succeeds and
+      // returns nothing, so `clock()` fails while decoding the empty return data rather than
+      // inside the call — and a decode failure is not what `try/catch` is there to catch. An EOA
+      // would otherwise be refused by a bare panic instead of a named error.
+      if (token.code.length == 0) revert CensusModeRequiresToken();
+
+      uint48 snapshot = _previousTimepoint(token);
+
+      // Probe the exact call every input will make. `_previousTimepoint` swallows a missing
+      // `clock()` and falls back to block numbers, which is right for a token that predates
+      // ERC-6372 but also lets an address that is not a votes token pass validation — and then
+      // every `publishInput` reverts inside `getPastVotes`, after the fee is paid.
+      try IVotesToken(token).getPastVotes(address(0), snapshot) returns (uint256) {} catch {
+        revert CensusModeRequiresToken();
+      }
+
+      round.snapshot = snapshot;
+    }
+  }
+
   /// @inheritdoc IE3Program
   function publishInput(uint256 e3Id, bytes memory data) external {
     E3 memory e3 = interfold.getE3(e3Id);
@@ -256,9 +363,6 @@ contract CRISPProgram is IE3Program, Ownable {
       revert E3NotAcceptingInputs(e3Id);
     }
 
-    // We need to ensure that the CRISP admin set the merkle root of the census.
-    if (e3Data[e3Id].merkleRoot == 0) revert MerkleRootNotSet();
-
     if (data.length == 0) revert EmptyInputData();
 
     (bytes memory noirProof, address slotAddress, bytes32 encryptedVoteCommitment, bytes memory encryptedVote) = abi.decode(
@@ -266,26 +370,81 @@ contract CRISPProgram is IE3Program, Ownable {
       (bytes, address, bytes32, bytes)
     );
 
+    // The two census families differ here and nowhere else. A Merkle round proves membership
+    // inside the circuit against a posted root. An ONCHAIN round reads the power from the token
+    // and gives it to the circuit, so the eligibility check has to happen here instead.
+    (bytes32 eligibility, IHonkVerifier verifier) = _eligibility(e3Id, slotAddress);
+
     (uint40 voteIndex, bytes32 previousEncryptedVoteCommitment) = _processVote(e3Id, slotAddress, encryptedVoteCommitment);
 
     // Set the public inputs for the proof. Order must match Noir circuit.
-    bytes32[] memory noirPublicInputs = new bytes32[](7);
+    bytes32[] memory noirPublicInputs = new bytes32[](9);
     noirPublicInputs[0] = previousEncryptedVoteCommitment;
-    noirPublicInputs[1] = bytes32(e3Data[e3Id].merkleRoot);
-    noirPublicInputs[2] = bytes32(uint256(uint160(slotAddress)));
-    noirPublicInputs[3] = bytes32(uint256(previousEncryptedVoteCommitment == bytes32(0) ? 1 : 0));
-    noirPublicInputs[4] = bytes32(e3Data[e3Id].numOptions);
-    noirPublicInputs[5] = encryptedVoteCommitment;
-    noirPublicInputs[6] = e3.committeePublicKey;
+    // A Keccak digest does not fit in one field element, so it enters the circuit as its two
+    // 16-byte halves. The circuit rebuilds the 32 bytes with `digest_from_halves`.
+    {
+      uint256 digest = uint256(ballotDigest(e3Id, slotAddress, encryptedVoteCommitment));
+      noirPublicInputs[1] = bytes32(digest >> 128);
+      noirPublicInputs[2] = bytes32(digest & type(uint128).max);
+    }
+    noirPublicInputs[3] = bytes32(uint256(uint160(slotAddress)));
+    noirPublicInputs[4] = eligibility;
+    noirPublicInputs[5] = bytes32(uint256(previousEncryptedVoteCommitment == bytes32(0) ? 1 : 0));
+    noirPublicInputs[6] = bytes32(e3Data[e3Id].numOptions);
+    noirPublicInputs[7] = encryptedVoteCommitment;
+    noirPublicInputs[8] = e3.committeePublicKey;
 
     // Check if the ciphertext was encrypted correctly
-    if (!honkVerifier.verify(noirProof, noirPublicInputs)) {
+    if (!verifier.verify(noirProof, noirPublicInputs)) {
       revert InvalidNoirProof();
     }
 
     emit InputPublished(e3Id, encryptedVote, voteIndex);
   }
 
+  /// @notice Resolve the eligibility public input and the verifier for a round.
+  /// @dev Returns the value that occupies index 4 of the circuit public inputs. The `crisp` and
+  /// `crisp_onchain` circuits agree on every other position, so this one value and the verifier
+  /// address are the whole difference between the two paths.
+  /// @param e3Id The E3 the input belongs to.
+  /// @param slotAddress The slot the input is written to.
+  /// @return eligibility The Merkle root of the census, or the voting power of the slot.
+  /// @return verifier The verifier that matches the circuit of this round.
+  function _eligibility(uint256 e3Id, address slotAddress) internal view returns (bytes32 eligibility, IHonkVerifier verifier) {
+    RoundData storage round = e3Data[e3Id];
+
+    if (round.censusMode != CensusMode.ONCHAIN) {
+      // We need to ensure that the CRISP admin set the merkle root of the census.
+      if (round.merkleRoot == 0) revert MerkleRootNotSet();
+      return (bytes32(round.merkleRoot), honkVerifier);
+    }
+
+    uint256 power = IVotesToken(round.token).getPastVotes(slotAddress, round.snapshot);
+
+    // A slot with no power is never writable, whatever the round configured. Without this floor a
+    // round with `minVotingPower == 0` would let anyone mask any address, including addresses that
+    // never held the token.
+    uint256 threshold = round.minVotingPower == 0 ? 1 : round.minVotingPower;
+    if (power < threshold) revert SlotNotEligible();
+
+    // Eligibility comes from the power at the snapshot. The weight the circuit enforces comes from
+    // the credit mode, so a CONSTANT round gives every eligible slot the same credits.
+    return (bytes32(round.creditMode == CreditMode.CONSTANT ? round.credits : power), onchainHonkVerifier);
+  }
+
+  /// @notice The last finalized timepoint of a token, in its ERC-6372 clock units.
+  /// @dev Falls back to block numbers when the token has no `clock()`, which matches the default
+  /// ERC20Votes clock.
+  /// @param token The token to read the clock of.
+  /// @return The timepoint before the current one.
+  function _previousTimepoint(address token) internal view returns (uint48) {
+    try IERC6372Clock(token).clock() returns (uint48 current) {
+      return current == 0 ? 0 : current - 1;
+    } catch {
+      return uint48(block.number - 1);
+    }
+  }
+
   /// @notice Decode the tally from the plaintext output
   /// @param e3Id The E3 program ID
   /// @return votes - an array of vote counts for each option

package/contracts/CRISPVerifier.sol

@@ -7,85 +7,85 @@ pragma solidity >=0.8.21;
 
 uint256 constant N = 2097152;
 uint256 constant LOG_N = 21;
-uint256 constant NUMBER_OF_PUBLIC_INPUTS = 15;
-uint256 constant VK_HASH = 0x0a7642f3693429035e756c034137ba93ed0bc3e7d3f370e24143d7e52a7aabc4;
+uint256 constant NUMBER_OF_PUBLIC_INPUTS = 17;
+uint256 constant VK_HASH = 0x1d0e6ec8f2fe720a1f528f02a66b66c1479c1648afaaedec06d89b889a0ff0c2;
 library HonkVerificationKey {
   function loadVerificationKey() internal pure returns (Honk.VerificationKey memory) {
     Honk.VerificationKey memory vk = Honk.VerificationKey({
       circuitSize: uint256(2097152),
       logCircuitSize: uint256(21),
-      publicInputsSize: uint256(15),
+      publicInputsSize: uint256(17),
       ql: Honk.G1Point({
-        x: uint256(0x14493dc1077b2f351879feecaa600ca60f7ce233869e11f274bb6fc7d31427dd),
-        y: uint256(0x03269bd3e0e7fcd095c3a6eaddf8e30e33ca383497034c7e028ddc372df027da)
+        x: uint256(0x2089549d27c8b4fa58dd4ed5276c42ccc9830ee5cd64cf877df0301a02d54e62),
+        y: uint256(0x01137e39f6b1ec6101fad7a4472102bfe11e7534e55e58109734c4b927efe6a6)
       }),
       qr: Honk.G1Point({
-        x: uint256(0x1fa18580baf7ded1c161e13ca6a20c5670ef984a3396979faf7e0a656387e527),
-        y: uint256(0x2e94ddf45aecdaee626a6eeded33d0feda0b05fe0681f3ee3d6340a4a8c10896)
+        x: uint256(0x0c9d534606fb88b2814caaec28c8f0ccd9f903b2236fe399ce723cb7a89cff54),
+        y: uint256(0x12d1f3a930e1c9be768e98d5ed2c5c74b3bd1bce2f50ce042cde7270f8032df1)
       }),
       qo: Honk.G1Point({
-        x: uint256(0x092b0d4c826cbe5e07c1e19020272e116ff633dc953763c357f5fd841722123e),
-        y: uint256(0x2c32eb8ab851dfe95645d6e6c15d5074c4e3d179d58aa0ed636f7dfafabecede)
+        x: uint256(0x18424976826978ddb710bfdc21c64a296884c27b0d8dadf6ac7681445dde8d8c),
+        y: uint256(0x1690625dd2a2a6afa259cfe9dc7601058bd3275e8fcea82e008caa319c2710b4)
       }),
       q4: Honk.G1Point({
-        x: uint256(0x25306c50d5acbe8b63f31114c2a33abd494ee69eaf0d83dfd5a2a77c6c7694dc),
-        y: uint256(0x1a86fb908a0a332216ad4e0651be7f73f720d402f00ce3e8b32e94b89f25087f)
+        x: uint256(0x025aeec2f923a237df2c5ddfe9bc1af74bdaf41d2fe47aa4c0cb12dc4cafac76),
+        y: uint256(0x0a3ecdb966ed757ad3acc3e2ad670b804b582686b85bdad85ebe18713cddd85e)
       }),
       qm: Honk.G1Point({
-        x: uint256(0x26516743e498c0fd06b97618fb55478fd29807b4d6305ca3bb2d7b506264fd6f),
-        y: uint256(0x10bb22b28f6420cea07563e6114b960dd9bdbf203ad39a4bed6b42d014fff8f9)
+        x: uint256(0x1b562d7113fa8ac2dec528dfcec26f0c0b1290f9a0fa7cd08ee8492b7f8ed657),
+        y: uint256(0x188c0bdd795dda2f441f73f4a93919cf28417e039c491966c4305582edfcf63f)
       }),
       qc: Honk.G1Point({
-        x: uint256(0x14e3747585344848708d74e5cac292bd806b04496ce2a1f19b832be2b06a46a0),
-        y: uint256(0x24e01d1273374ee4f50c390758c45738b0dee956af2038acbd53b58d4b74779a)
+        x: uint256(0x0b824186ff62956e929ad489895b6f94e44fedde51b9c7ada98f43339fa875e2),
+        y: uint256(0x288402862aac013f44d9af847a2a1b318e8f3c026d50818ed5467c252505f8b8)
       }),
       qLookup: Honk.G1Point({
         x: uint256(0x0000000000000000000000000000000000000000000000000000000000000000),
         y: uint256(0x0000000000000000000000000000000000000000000000000000000000000000)
       }),
       qArith: Honk.G1Point({
-        x: uint256(0x176c5cf9eb8c27900484c632289e86dfbfab9d4bbc5d927e2fe3a79b36479290),
-        y: uint256(0x2fc22055c186e3bcd7b55e48688c899b5a5c804e3d7403f520776666dbb3f23e)
+        x: uint256(0x1eec43a65b0287ccdadfdee7b5c7f1edd764f78af3be146380f9285dc23935ac),
+        y: uint256(0x00334d21a1e3fdb81573ecfedf177b7a266b994f7c03e603d22c1d50a14c1177)
       }),
       qDeltaRange: Honk.G1Point({
-        x: uint256(0x2d0e8c12eebb1f0a1604752470e237658a92f612da2abc65a791cc777a35a341),
-        y: uint256(0x23ebdb221e2fc512e6bce94cc3701880ee87e340c16e2fcce619ee8e97949e56)
+        x: uint256(0x1fbf72c051dd975693c7581ba456e27c8779526d6226300b89fdcb2f46236846),
+        y: uint256(0x15c7e84bd025a07f602a5ced777d9a6dc519fa77e263fd6ae739a872ced3403b)
       }),
       qElliptic: Honk.G1Point({
         x: uint256(0x0000000000000000000000000000000000000000000000000000000000000000),
         y: uint256(0x0000000000000000000000000000000000000000000000000000000000000000)
       }),
       qMemory: Honk.G1Point({
-        x: uint256(0x0f8820a8b43ed7f9a6e0aa355bf3ef04dc47c88a221a6c41a4f253e50783fab4),
-        y: uint256(0x2de4b7c386bedbf5694b899eb29dd3c1be6e7691ecc10d4074966cfe8efb0421)
+        x: uint256(0x047852a9a4fee8460c8a70000bd59b1e9fa7b3a8ebe89a4a9bd74f8b667ec0e3),
+        y: uint256(0x206a2850fbba93adfaaf19b47f64be4050e7e3d0934e3bb3c152c6d0ebf9bc6e)
       }),
       qNnf: Honk.G1Point({
-        x: uint256(0x19a8398c7b609f27c334c656127ebdc34db4982bb1f1bbec186873c113d2f0b1),
-        y: uint256(0x29c36f8a702f73fec6a32d581fdc17e59c4999625d7c9147e7eac48df66b1740)
+        x: uint256(0x1bbbf2123e3d8fb40a55063fc262031ed631ba08b2403fc66be28284d8bf81f0),
+        y: uint256(0x22ed7e7b495a40b67a9131d0ec78104425c718cfcb4a1d539cc0efb438863481)
       }),
       qPoseidon2External: Honk.G1Point({
-        x: uint256(0x00fd3df42aead1d3fe2aedac899b5a5a1d33072137bbf9cd98933a7f939ca4af),
-        y: uint256(0x0daa73db37e213845ad80630816c01724f21e0151759b18358a51651bbc5ef49)
+        x: uint256(0x0545a1bebaefe1aed53b541c02ff5f8dc6ea9fcf3790df43723cec27fad71211),
+        y: uint256(0x0f6e3454a6b2e0f9ef6e3c3c420d2212f9b9611dcc56c93cb3f7b3a843b8b061)
       }),
       qPoseidon2Internal: Honk.G1Point({
-        x: uint256(0x0d04ebec0a4f4c5343b72c528f4de039629eab96223847720e5fb619b1a8f10d),
-        y: uint256(0x128f4178942625efadd7fe3adbaeb337fd961488236802d50ece4a7552e96370)
+        x: uint256(0x1dc8084a81e94401164ab0cc7dd600fdcccf393611a00c881b100f125a7c2cae),
+        y: uint256(0x1b45db8582b61bd1f9938b966fd2c62007a4e6b29bd12d93300fc87fc248541c)
       }),
       s1: Honk.G1Point({
-        x: uint256(0x0774647b2dca67d5649beb99b794a2eb00df29cf5f41a651f1dbd4ef6e9efbf7),
-        y: uint256(0x2f0f9a00cfdd4915a84eeecae14991cf8aed2f0efc17685988b2c5513a868150)
+        x: uint256(0x0055c092383ecaa42ba772ccd0dc288af43851c2230e18ce204b0b921c565ebb),
+        y: uint256(0x29586aa1c092712c4d7337d3017e2ca1c0b460b5020366e3a218f5dbdb65dac3)
       }),
       s2: Honk.G1Point({
-        x: uint256(0x07fb7e3aefe3a10bf887114d2d23a0e6e625695d1edc4507aaa362cf13cbe95b),
-        y: uint256(0x27c70c4226f232a5649e44053b2b71db25553c54f57ade536e7a60a7e4321836)
+        x: uint256(0x03c15d176f3295a287398c9bd47ebcbae4206b787ae7f99a0b4b845ba42c5b8f),
+        y: uint256(0x06046a4ecd73c3a079fdd9b1aadb3ec8a10d81bbdfff4fe64491b5d73850c951)
       }),
       s3: Honk.G1Point({
-        x: uint256(0x28cd82d09235cab51c5909d625fd077e6b1c19e3f9d74963ebd6be11d165c8fa),
-        y: uint256(0x1f13e6a87683c7105f1ad021f09f02db97654f78c52d549b8b927794f5fdde58)
+        x: uint256(0x2ab36d90282916edcc8344a83329989d6ab32ce72e50a8c5fb71bdc96cc13bba),
+        y: uint256(0x1f91bde663a11f2dd1c2189801544154219b96fc15c228a2afaf94c2fd525614)
       }),
       s4: Honk.G1Point({
-        x: uint256(0x2706b7dbb9755b086936581aa3d9c43e6e24f1dc44e8d6268d1ae9e80b52015e),
-        y: uint256(0x237ab989a520291d485957047de8e083cfd74afb501593c9429c9d40b5b8a070)
+        x: uint256(0x20e8b44228a8581f3b89daf0afd122fb5eb9b54235e5f3006f4da3ced24a4bff),
+        y: uint256(0x121da33cdfeb99d9117a23a70ca53f0409a753f28e8217d6297f2d890507fa06)
       }),
       t1: Honk.G1Point({
         x: uint256(0x0000000000000000000000000000000000000000000000000000000000000000),
@@ -104,28 +104,28 @@ library HonkVerificationKey {
         y: uint256(0x0000000000000000000000000000000000000000000000000000000000000000)
       }),
       id1: Honk.G1Point({
-        x: uint256(0x117f92d3a69b1401f1b3eb19da6bf4dacd4a0c7b0fbc2767112674ae33356634),
-        y: uint256(0x18d8c2c0d2dab140e273b4607eda1ebb4560dbb0c8299e21e702a20d2252b91a)
+        x: uint256(0x165a0d0053cad2cfaf860a8dffc7b857ae52a0830a5d0ff389f126736c8a68af),
+        y: uint256(0x1230c74e80658090adff46f20a5ba230b00a36fa1647bbee26dcd4f61c81ac74)
       }),
       id2: Honk.G1Point({
-        x: uint256(0x2cffdc37befb4d7147f9b1e40dc54b529684766c4f6ed722a08af2080129fa8c),
-        y: uint256(0x0f9ea00342ceb61caea3d52750c757d17b6d4d63fc7d855d4b3fdbad8566cab9)
+        x: uint256(0x0cde9685338036c896bf8031dfb4a27df07170d25a17a6f3487ff9dbc2d58d97),
+        y: uint256(0x2ba321fb18bb8416deb007188ba7eaf7d9acc32649feb97b99b61a385503e561)
       }),
       id3: Honk.G1Point({
-        x: uint256(0x04b9f40f2cd4123d03663d63758856d3f947c857cdb16e4c45587df95a5239c1),
-        y: uint256(0x149255bba819e1a349307d4a334143f77028d663bee3a4761177dd5f5610df21)
+        x: uint256(0x1803faf5351782f647e62d18cffbd667c89844b034d38e49c4317b6c6c262efc),
+        y: uint256(0x00d296c60b3f1ad4f263c6c0cf1c931573e621b89604b5a18add83543af491fb)
       }),
       id4: Honk.G1Point({
-        x: uint256(0x2b8aba03c2291ad20411a8f5c9eafa2177e093539e88f085c376496455ce16ab),
-        y: uint256(0x2b2cda526df47bdb8ff2257b7c3b8eadfcd5c195ad0d619ddcc3a960ece05656)
+        x: uint256(0x22136f96d01a39d6cd8808212c2d90f8f539d0c302bbfbe0856ec5858d14026e),
+        y: uint256(0x0c8e6eb560ae1fe67f9341f70bc50ad204ee5da5814a40a811d777be4d796ad7)
       }),
       lagrangeFirst: Honk.G1Point({
         x: uint256(0x2a56ce41f6b0be13b9c26747621b821eee81b23a887f299049b14c11e98460d6),
         y: uint256(0x1aa98f2de3ddda547d8f6de4e725ded5827d6338c78656c0d12ca1aea6ef2c7c)
       }),
       lagrangeLast: Honk.G1Point({
-        x: uint256(0x100c5101d69d23da354afa62b1d0354277b5f12dc6dbd26b1b33eae7973aca5a),
-        y: uint256(0x2ae821e69f12831c7dd899a431ff8eb56f8637b07fbd23ca8abcaae6ea299326)
+        x: uint256(0x054b6343cdc2405ed0b8e6603bd33aad161e52d8b252ff7916e72f9474fb5c92),
+        y: uint256(0x0d9a27acd4b305126491136fbce26d1bc29ecf5b067fe121b87d7347cdf3baf0)
       })
     });
     return vk;

package/contracts/Mocks/MockInterfold.sol

@@ -30,6 +30,35 @@ contract MockInterfold {
     _request(program, numOptions);
   }
 
+  /// @notice Request an E3 with caller-supplied program params.
+  /// @dev `_request` hardcodes a TOKEN-census round. `CensusMode.ONCHAIN` needs a token, a credit
+  /// mode and a census mode that only the caller knows, and the snapshot is taken during
+  /// `validate`, so the params have to reach it here rather than being patched afterwards.
+  function requestWithParams(address program, uint256 numOptions, bytes memory params) external {
+    e3s[nextE3Id] = E3({
+      seed: 0,
+      committeeSize: IInterfold.CommitteeSize.Minimum,
+      requestBlock: 0,
+      inputWindow: [uint256(0), uint256(0)],
+      encryptionSchemeId: ENCRYPTION_SCHEME_ID,
+      e3Program: IE3Program(address(0)),
+      paramSet: 0, // Insecure512
+      customParams: params,
+      decryptionVerifier: IDecryptionVerifier(address(0)),
+      pkVerifier: IPkVerifier(address(0)),
+      committeePublicKey: committeePublicKey,
+      ciphertextOutput: bytes32(0),
+      plaintextOutput: plaintextOutput,
+      requester: address(0),
+      ciphertextCommitment: bytes32(0)
+    });
+
+    IE3Program(program).validate(nextE3Id, 0, bytes(""), bytes(""), params);
+
+    nextE3Id++;
+    numOptions; // silence unused-parameter warning; the count travels inside `params`
+  }
+
   function _request(address program, uint256 numOptions) internal {
     e3s[nextE3Id] = E3({
       seed: 0,

package/contracts/Mocks/MockVotesToken.sol

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+pragma solidity ^0.8.27;
+
+import { ERC20 } from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import { ERC20Permit } from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Permit.sol";
+import { ERC20Votes } from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Votes.sol";
+import { Nonces } from "@openzeppelin/contracts/utils/Nonces.sol";
+
+/// @title MockVotesToken
+/// @notice An ERC20Votes token for exercising `CensusMode.ONCHAIN`.
+/// @dev `MockVotingToken` is a plain ERC20 with no `getPastVotes`, which makes it the negative
+/// case for the token probe in `CRISPProgram._initRound`. This one is the positive case.
+///
+/// Uses the timestamp clock, matching `InterfoldToken`. A round records its snapshot in whatever
+/// units the token reports, so a mock on the default block-number clock would exercise a
+/// different path from the token this mode is built for.
+contract MockVotesToken is ERC20, ERC20Permit, ERC20Votes {
+  constructor() ERC20("Mock Votes Token", "MVOTE") ERC20Permit("Mock Votes Token") {
+    _mint(msg.sender, 1e24);
+    _delegate(msg.sender, msg.sender);
+  }
+
+  function mint(address to, uint256 amount) external {
+    _mint(to, amount);
+    if (delegates(to) == address(0)) _delegate(to, to);
+  }
+
+  function clock() public view override returns (uint48) {
+    return uint48(block.timestamp);
+  }
+
+  /// @dev Declared pure per ERC-6372, so it cannot read `clock()`.
+  function CLOCK_MODE() public pure override returns (string memory) {
+    return "mode=timestamp";
+  }
+
+  function _update(address from, address to, uint256 value) internal override(ERC20, ERC20Votes) {
+    super._update(from, to, value);
+  }
+
+  function nonces(address owner) public view override(ERC20Permit, Nonces) returns (uint256) {
+    return super.nonces(owner);
+  }
+}

package/contracts/interfaces/IERC6372Clock.sol

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+pragma solidity >=0.8.27;
+
+/// @notice The ERC-6372 clock of a token, used to record the snapshot of a round.
+/// @dev Kept separate from `IVotesToken` because it is the optional half of the token surface.
+/// A token that predates ERC-6372 still answers `getPastVotes`, so `CRISPProgram` falls back to
+/// block numbers when this call reverts rather than refusing the round.
+interface IERC6372Clock {
+  /// @notice The current timepoint, in the clock units of the token.
+  /// @return The timepoint.
+  function clock() external view returns (uint48);
+}

package/contracts/interfaces/IHonkVerifier.sol

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+pragma solidity >=0.8.27;
+
+/// @notice The subset of a generated Honk verifier that `CRISPProgram` calls.
+/// @dev Declared as an interface so the census paths can hold verifiers generated from different
+/// circuits. `CRISPVerifier.sol` and `CRISPOnchainVerifier.sol` both declare a contract named
+/// `HonkVerifier`, so importing both concrete types would collide.
+interface IHonkVerifier {
+  /// @notice Verify a folded ballot proof against its public inputs.
+  /// @dev Reverts rather than returning false when the public inputs do not match the proof.
+  /// @param proof The folded proof.
+  /// @param publicInputs The public inputs, in the order the fold circuit declares them.
+  /// @return True when the proof is valid.
+  function verify(bytes calldata proof, bytes32[] calldata publicInputs) external view returns (bool);
+}

package/contracts/interfaces/IVotesToken.sol

@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+pragma solidity >=0.8.27;
+
+/// @notice The subset of an ERC20Votes token that `CensusMode.ONCHAIN` reads.
+/// @dev Required, not optional. A round that names a token which cannot answer this is rejected
+/// at request time, because every input would otherwise revert here after the fee is paid.
+interface IVotesToken {
+  /// @notice The voting power of an account at a past timepoint.
+  /// @param account The account to read.
+  /// @param timepoint The timepoint, in the ERC-6372 clock units of the token.
+  /// @return The voting power at that timepoint.
+  function getPastVotes(address account, uint256 timepoint) external view returns (uint256);
+}